2026-11-01_eaff377a7421772a6ed98f52c0ce5748_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_eaff377a7421772a6ed98f52c0ce5748_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 17.6MB
Sample261102-e3mhjasw2p
SHA256 2757559d8bb3b36ed92e10aadd4b9dd36dcc412830982b588fa0cad271d69826
MD5 eaff377a7421772a6ed98f52c0ce5748
SHA1 bbb4daa5121aad8dc7f8d63b8d86213417d8955e
SHA512 23b77c2c83696b67ba2e992ff57311acd02114884de796ae212f30790d1e8355ba034e306c2d6c74863049d4234edcced227cd02c08b5865a693a5abd7204116
SSDEEP 393216:qs/CUFKAbxvh2opWXRCT5IXKl27TKYiv4kTA:1qUoirpmYIW27eYABA
TLSH
T1DC077E71F7468026E09602B19E3C5B6BC77CEA260BA441D752D4EA293D7D9C33F31B92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-01_eaff377a7421772a6ed98f52c0ce5748_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

.exe 17.6MB

2026-11-01_eaff377a7421772a6ed98f52c0ce5748_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader

IMPHASH b4c71aa49b986ea5ce1500b37a09f538
SHA256 2757559d8bb3b36ed92e10aadd4b9dd36dcc412830982b588fa0cad271d69826
MD5 eaff377a7421772a6ed98f52c0ce5748
SHA1 bbb4daa5121aad8dc7f8d63b8d86213417d8955e
SHA512 23b77c2c83696b67ba2e992ff57311acd02114884de796ae212f30790d1e8355ba034e306c2d6c74863049d4234edcced227cd02c08b5865a693a5abd7204116
SSDEEP 393216:qs/CUFKAbxvh2opWXRCT5IXKl27TKYiv4kTA:1qUoirpmYIW27eYABA
TLSH
T1DC077E71F7468026E09602B19E3C5B6BC77CEA260BA441D752D4EA293D7D9C33F31B92
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

ea:d6:14:3b:c8:49:e2:a2:1a:8f:c1:7a:24:6a:9d:23:b4:5e:b4:e1:eb:19:9e:6f:22:a1:69:cb:04:18:0f:c9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,C=DE

Chains

Oct 16, 2026

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,C=DE

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,C=DE

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,C=DE

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,C=DE

Serial Number

04:7d:f4:69:4f:cc:50:04:b5:cf:f6:be:10:bf:c8:e8

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 17, 2026 - May 6, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

11746224

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\WS\tv_prel_dcr\build_cmake_win\FULL\Release\TeamViewer_Desktop.pdb

dbghelp

SymFromAddr SymSetOptions SymGetOptions SymInitialize

ksuser

KsCreatePin

wevtapi

EvtQuery EvtNext EvtRender EvtCreateRenderContext EvtClose

api-ms-win-core-libraryloader-l1-2-0

SizeofResource LoadStringA FreeLibraryAndExitThread GetModuleHandleExW LoadLibraryExW LoadLibraryExA LoadResource LoadStringW LockResource GetModuleFileNameA GetModuleHandleW GetProcAddress FreeLibrary GetModuleFileNameW GetModuleHandleA

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo GetWindowsDirectoryW GetLogicalProcessorInformationEx GetTickCount GetVersion GetSystemDirectoryW GetSystemTime GetSystemTimeAsFileTime GetSystemDirectoryA GetTickCount64 GlobalMemoryStatusEx

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineA SetStdHandle ExpandEnvironmentStringsW SetEnvironmentVariableW GetCommandLineW GetEnvironmentVariableW

api-ms-win-core-processthreads-l1-1-0

TlsAlloc CreateProcessW TlsGetValue GetCurrentThread GetStartupInfoW GetExitCodeThread GetCurrentProcessId GetThreadId OpenProcessToken SetThreadPriority GetCurrentThreadId ExitProcess CreateThread ProcessIdToSessionId TerminateThread QueueUserAPC GetProcessTimes TlsFree TlsSetValue SetProcessShutdownParameters ExitThread GetCurrentProcess SetPriorityClass TerminateProcess GetPriorityClass CreateProcessAsUserW ResumeThread

api-ms-win-core-com-l1-1-0

CoCreateInstance CoTaskMemRealloc PropVariantClear CoInitializeEx CoSetProxyBlanket CoTaskMemAlloc CoCreateFreeThreadedMarshaler CoInitializeSecurity StringFromGUID2 CoTaskMemFree CLSIDFromString

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW RegGetValueA RegOpenCurrentUser RegEnumValueW RegFlushKey RegQueryValueExA RegCloseKey RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegDeleteKeyExW RegOpenKeyExW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockShared CreateEventA AcquireSRWLockShared AcquireSRWLockExclusive SetEvent ReleaseSRWLockExclusive InitializeSRWLock InitializeCriticalSectionAndSpinCount WaitForSingleObject ResetEvent TryAcquireSRWLockExclusive WaitForMultipleObjectsEx TryAcquireSRWLockShared DeleteCriticalSection InitializeCriticalSectionEx SleepEx ReleaseSemaphore SetWaitableTimer EnterCriticalSection LeaveCriticalSection WaitForSingleObjectEx InitializeCriticalSection CreateEventW OpenEventA

api-ms-win-core-errorhandling-l1-1-0

RaiseException SetLastError UnhandledExceptionFilter GetLastError SetUnhandledExceptionFilter

api-ms-win-core-string-l1-1-0

GetStringTypeExW CompareStringEx WideCharToMultiByte GetStringTypeW CompareStringW MultiByteToWideChar

api-ms-win-core-libraryloader-l1-2-1

FindResourceW LoadLibraryW LoadLibraryA

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects CreateWaitableTimerW CreateSemaphoreW

api-ms-win-core-io-l1-1-0

GetQueuedCompletionStatus CreateIoCompletionPort DeviceIoControl PostQueuedCompletionStatus CancelIoEx

api-ms-win-core-localization-l1-2-0

LCMapStringA GetCPInfo GetUserDefaultLCID IsValidCodePage GetLocaleInfoEx FormatMessageW IsValidLocale GetACP FormatMessageA LCMapStringEx EnumSystemLocalesW GetUserGeoID GetOEMCP GetGeoInfoW LCMapStringW GetLocaleInfoW GetSystemDefaultLCID

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

api-ms-win-core-heap-l2-1-0

LocalFree LocalAlloc

api-ms-win-core-file-l2-1-0

CopyFileExW GetFileInformationByHandleEx MoveFileExW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-file-l1-1-0

GetFileInformationByHandle GetFileAttributesExW FindClose SetFileInformationByHandle FindFirstFileExW WriteFile ReadFile CreateDirectoryW DeleteFileW FlushFileBuffers GetFileTime GetDriveTypeW GetFileAttributesW UnlockFileEx CreateFileW GetFileType SetEndOfFile SetFileAttributesW FindNextFileW FindFirstFileW GetFileSizeEx RemoveDirectoryW LockFileEx

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-eventlog-legacy-l1-1-0

DeregisterEventSource ReportEventW RegisterEventSourceW

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject GetComputerNameW GetSystemPowerStatus

api-ms-win-security-lsapolicy-l1-1-0

LsaClose LsaOpenPolicy LsaFreeMemory

api-ms-win-ntuser-sysparams-l1-1-0

EnumDisplayDevicesW SystemParametersInfoW EnumDisplayMonitors GetMonitorInfoW GetSystemMetrics

api-ms-win-core-localization-ansi-l1-1-0

GetStringTypeExA

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessAffinityMask SetProcessAffinityMask

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

SetDllDirectoryW VerifyVersionInfoW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter QueryPerformanceFrequency

api-ms-win-core-heap-l1-1-0

HeapSize GetProcessHeap HeapQueryInformation HeapReAlloc GetProcessHeaps HeapFree HeapSetInformation HeapAlloc

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage GetSystemDefaultUILanguage

api-ms-win-core-localization-l1-2-2

LCIDToLocaleName

api-ms-win-core-kernel32-legacy-l1-1-5

SetThreadExecutionState

sspicli

InitSecurityInterfaceW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-synch-ansi-l1-1-0

CreateSemaphoreA CreateWaitableTimerA

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid DuplicateTokenEx EqualSid ImpersonateLoggedOnUser SetTokenInformation AdjustTokenPrivileges GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor IsValidSid RevertToSelf FreeSid

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime

api-ms-win-core-psapi-l1-1-0

K32GetProcessMemoryInfo K32GetModuleBaseNameW K32GetModuleFileNameExW QueryFullProcessImageNameW K32EnumProcesses

api-ms-win-core-processthreads-l1-1-1

FlushInstructionCache OpenProcess IsProcessorFeaturePresent GetProcessHandleCount

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW SetSecurityInfo SetNamedSecurityInfoW GetNamedSecurityInfoW GetSecurityInfo

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW LookupPrivilegeValueW LookupAccountSidW

api-ms-win-core-toolhelp-l1-1-0

Process32FirstW Process32NextW CreateToolhelp32Snapshot

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe CreateNamedPipeW WaitNamedPipeW SetNamedPipeHandleState TransactNamedPipe

api-ms-win-security-cpwl-l1-1-0

CreateProcessWithLogonW

api-ms-win-service-management-l1-1-0

OpenSCManagerW

api-ms-win-core-processthreads-l1-1-2

GetSystemTimes

api-ms-win-core-privateprofile-l1-1-0

GetPrivateProfileStringW

api-ms-win-core-synch-l1-2-0

InitializeConditionVariable WakeAllConditionVariable InitOnceComplete SleepConditionVariableCS WakeConditionVariable Sleep InitOnceExecuteOnce InitOnceBeginInitialize SleepConditionVariableSRW

api-ms-win-core-memory-l1-1-0

VirtualQuery VirtualProtect

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureStackBackTrace RtlUnwind

api-ms-win-core-heap-obsolete-l1-1-0

GlobalSize GlobalLock GlobalUnlock

d2d1

ord1

api-ms-win-core-debug-l1-1-0

DebugBreak OutputDebugStringW

kernel32

OpenFileMappingA GetProcessShutdownParameters K32GetPerformanceInfo SetSearchPathMode Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection SetProcessDEPPolicy Module32FirstW Module32NextW GlobalAlloc GlobalFree IsDebuggerPresent CreatePipe InitializeProcThreadAttributeList UpdateProcThreadAttribute GetPrivateProfileIntW GetPrivateProfileSectionW WritePrivateProfileStringW SwitchToThread UnmapViewOfFile CreateFileMappingA MapViewOfFileEx OpenEventW WTSGetActiveConsoleSessionId GetFullPathNameW GetEnvironmentVariableA GetCurrentDirectoryW SetFilePointerEx ReleaseMutex CreateMutexW OpenMutexW GetFileSize GetDynamicTimeZoneInformation GetTimeZoneInformation GetTimeFormatW GetLogicalProcessorInformation GetDateFormatW VirtualFree VirtualAlloc OutputDebugStringA GetLocalTime

magnification

MagSetWindowFilterList MagSetImageScalingCallback MagUninitialize MagSetColorEffect MagSetWindowSource MagInitialize MagSetWindowTransform

api-ms-win-security-cryptoapi-l1-1-0

CryptDestroyHash CryptCreateHash CryptReleaseContext CryptHashData CryptGetHashParam CryptAcquireContextW

api-ms-win-core-interlocked-l1-1-0

InterlockedPopEntrySList InitializeSListHead InterlockedPushEntrySList

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler ReadConsoleW WriteConsoleW GetConsoleOutputCP GetConsoleMode

api-ms-win-core-fibers-l1-1-0

FlsFree FlsAlloc FlsGetValue FlsSetValue

api-ms-win-core-errorhandling-l1-1-1

RemoveVectoredExceptionHandler AddVectoredExceptionHandler

api-ms-win-security-systemfunctions-l1-1-0

SystemFunction036

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

12.3MB

Virtual Size

12.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

IPPCODE

Size

375KB

Virtual Size

374KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

372KB

Virtual Size

463KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

581KB

Virtual Size

581KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=20, id=260, version=35207,

count=34, id=259, version=35207,

count=43, id=259, version=35215,

count=125, id=261, version=35207,

count=50, id=205, version=50522,

count=1, id=263, version=35215,

count=146, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=861, productName=Unmarked objects (old),

count=223, id=261, version=35215,

count=3, id=262, version=35215,

count=50, id=260, version=35215,

count=11, id=257, version=35215,

count=826, id=1, productName=Unmarked objects,

count=673, id=260, version=35227,

count=2, id=259, version=35227,

count=468, id=261, version=35227,

count=1817, id=265, version=35227,

count=1, id=255, version=35227,

count=1, id=151,

count=1, id=258, version=35227,